Executive brief
The Linux kernel's mwifiex WiFi driver has a buffer handling flaw in its command processing. When a synchronous command wait is interrupted, the driver fails to detach the caller's stack-allocated data buffer from the firmware command. If the firmware responds after the caller has already returned and released their stack memory, the response handler writes data into stale stack addresses, corrupting kernel memory and causing system panics.
Technical details
The vulnerability is a use-after-free / stack corruption issue in the mwifiex synchronous command handler. The root cause is that when wait_event_interruptible_timeout() is interrupted or times out, the caller's data buffer (cmd_node->data_buf) remains attached to the command node even after the caller returns and the stack is released. A late firmware response then reaches the normal response handler, which copies data through the stale pointer into corrupted stack addresses. The attack vector requires either a malicious or malfunctioning WiFi firmware, or a network condition causing timeouts during association cycles. The fix detaches the caller-owned buffer from the command node when an interrupted wait is cancelled, preventing writes to invalid addresses. This issue has been resolved in the Linux kernel.
Affected products
- Linux Linux kernel versions with mwifiex driver (prior to patch)
Timeline
- 2026-09-11: disclosed